uppy vulnerabilities and fixes

Q: How do I fix uppy vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Q: Is uppy being exploited right now?

None of the tracked uppy CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Q: Which uppy CVE should I patch first?

CVE-2022-0086 currently ranks highest (62/100): uppy is vulnerable to Server-Side Request Forgery (SSRF).

Recent CVEs affecting uppy, with upgrade or downgrade steps. 3 tracked.

uppy has 3 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2022-03-03. Highest priority: CVE-2022-0086 (score 62/100).

CVE-2022-0528 MEDIUM 6.5 UPGRADE Server-Side Request Forgery (SSRF) in GitHub repository transloadit/uppy prior to 3.3.1.
CVE-2022-0086 CRITICAL 9.8 UPGRADE uppy is vulnerable to Server-Side Request Forgery (SSRF)
CVE-2020-8205 HIGH 7.5 UPGRADE The uppy npm package < 1.13.2 and < 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulner

FAQ

How do I fix uppy vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is uppy being exploited right now?

None of the tracked uppy CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which uppy CVE should I patch first?

CVE-2022-0086 currently ranks highest (62/100): uppy is vulnerable to Server-Side Request Forgery (SSRF).

RSS feed for uppy · ← Back to latest CVEs